Blue box

Local calling had been increasingly automated through the first half of the 20th century, but long-distance calling still required operator intervention. Automation was deemed essential by AT&T. By the 1940s they had developed a system that used audible tones played over the long-distance lines to control network connections. Tone pairs, referred to as multi-frequency (MF) signals, were assigned to the digits used for telephone numbers. A different, single tone, referred to as single frequency (SF), was used as a line status signal.

This new system allowed the telephone network to be increasingly automated by deploying the dialers and tone generators on an as-required basis, starting with the busier exchanges. Bell Labs was happy to advertise their success in creating this system, and repeatedly revealed details of its inner workings. In the February 1950 issue of Popular Electronics, they published an advertisement, Playing a Tune for a Telephone Number, which showed the musical notes for the digits on a staff and described the telephone operator's pushbuttons as a "musical keyboard".[2] Two keys on a piano would need to be pushed simultaneously to play the tones for each digit. The illustration did not include the tone pairs for the special control signals KP and ST, although in the picture the operator's finger is on the KP key and the ST key is visible. In the 1950s, AT&T released a public relations film, "Speeding Speech", which described the operation of the system. In the film, the tone sequence for sending a complete telephone number is heard through a loudspeaker as a technician presses the keys for dialing.[3]

In November 1954, the Bell System Technical Journal published an article entitled "In-Band Single-Frequency Signaling", which described the signaling scheme used for starting and ending telephone calls for the purpose of routing over trunk lines.[4][5] In November 1960, an article in the Bell System Technical Journal provided an overview of the technical details of signaling systems, and disclosed the frequencies of the signals.[6]

The system was relatively complex for 1950s technology. It had to accurately decode the frequencies and ignore any signals where that frequency might be accidentally created; music playing in the background might randomly contain the SF tones and the system had to filter these out. To do this, the signaling unit compared the signal power from a bandpass filter centered on 2600 Hz to signal power in other parts of the audio band, and only triggered if the tone was the most prominent signal. The originating end of the call would play the tone into the trunk line when the call ended, and trigger the remote end to end the call. After a short time, the originating end reduced the tone level and continued to send tone as long as it received on hook status from its local equipment.

Before the technical details were published, many users discovered unintentionally, and to their annoyance, that a 2600 Hz tone played into the caller's handset would cause a long-distance call to disconnect. The 2600 Hz tone might be present if the caller were whistling into the telephone microphone while waiting for the called party to answer. Upon detecting the tone from the caller's end, the receiving signaling unit sent an on hook status to the connected equipment, which disconnected the call from that point forward, as if the caller had hung up.

Among the earliest to discover this effect was Joe Engressia, known as Joybubbles, who accidentally discovered it at the age of seven by whistling. He became fascinated with the phone network, and over the next decade had built up a considerable base of knowledge about the system and how to place calls using the control tones. He and other phone phreaks, such as "Bill from New York" and "The Glitch", trained themselves to whistle 2600 Hz to reset a trunk line. They also learned how to route telephone calls by flashing, that is using very short pulses of the on-hook signal, to send routing instructions.

At one point in the 1960s, packages of the Cap'n Crunch breakfast cereal included a free gift: a small whistle that, by coincidence, generated a 2600 Hz tone when one of the whistle's two holes was covered.[7] The phreaker John Draper adopted his nickname "Captain Crunch" from this whistle.[8]

The "toll free" 800 service was launched in 1967 and gave the hackers easy numbers to call. The user would generally choose a number in the target area and then use it as above. Even if billing information were generated, it would be to a 1-800 number and thus free of charge. As before, the remote system would notice a call going to the ultimate non-free number, but could not match the other end.

It was technically possible to generate the tones with the technology available at the time the system was first deployed. A piano or electronic organ had keys that were close enough in frequency to work. With tuning, they could even be made dead on frequency. For dialing the phone number, the user would press 2 keys at a time. An experienced pianist might have found the key combinations awkward to play. But a blank player piano roll could have been punched to operate the required keys and dial a phone number. Another strategy would have been to purchase doorbells, remove the plungers, and mount them on a frame that could be set over the piano keyboard. Twelve DPDT pushbuttons, labelled KP, ST and the 10 digits, would operate pairs of plungers to play the phone company tones, after the E7 piano key had been pressed and released.

At the time, there were consumer devices for recording on wire or blank phonograph records, so the piano did not have to be near the phone. Consumer tape recorders came later and made the recording process easier. Small, battery powered, tape recorders allowed the tones to be played back almost anywhere.

It was possible to construct an electronic blue box with 1940s vacuum tube technology, but the device would have been relatively large and power hungry. Just as it did for radios, shrinking them from the size of toasters to the size of cigarette packages and allowing them to be powered by small batteries, transistor technology made a small, battery powered, electronic blue box practical.

AT&T security captured its first blue box in about 1962, but it probably was not the first one built.

A typical blue box had 13 pushbuttons. One button would be for the 2600 Hz tone, pressed and released to disconnect the outgoing connection and then connect a digit receiver. There would be a KP button, to be pressed next, 10 buttons for telephone number digits, and the ST button to be pressed last. The blue box may have had 7 oscillators, 6 for the 2 out of 6 digit code and one for the 2600 Hz tone, or 2 oscillators with switchable frequencies.

The blue box was thought to be a sophisticated electronic device and sold on the black market for a typical $800–1,000 or as much as $3,500. Actually, designing and building one was within the capabilities of many electronics students and engineers with knowledge of the required tones, using published designs for electronic oscillators, amplifiers and switch matrixes, and assembled with readily available parts. Furthermore, it was possible to generate the required tones using consumer products or lab test equipment. The tones could be recorded on small, battery powered, cassette recorders for playback anywhere.

To reduce call set up time, telephone numbers were transmitted from machine to machine in a "speed dial" format, about 1.5 seconds for a 10 digit number, including KP and ST. To catch the cheaters, AT&T could have connected monitors to digit receivers that were not being used for operator dialed calls and logged calls dialed at manual speed. So, some hackers went to the extra trouble of building blue boxes that stored telephone numbers and played the tones with the same timing as the machines.

The widespread ability to blue box, once limited to just a few isolated individuals exploring the telephone network, developed into a subculture.[9][10] Famous phone phreaks such as "Captain Crunch", Mark Bernay,[11]^: 125 and Al Bernay used blue boxes to explore the various "hidden codes" that could not be dialled by a standard telephone.

Some of the more famous pranksters were Steve Wozniak and Steve Jobs, founders of Apple Computer.[12] On one occasion, Wozniak dialed Vatican City and identified himself as Henry Kissinger (imitating Kissinger's German accent) and asked to speak to the Pope (who was sleeping at the time).[13][12] Wozniak said in 1986:[14]

I called only to explore the phone company as a system, to learn the codes and tricks. I'd talk to the London operator, and convince her I was a New York operator. When I called my parents and my friends, I paid. After six months I quit—I'd done everything that I could.

I was so pure. Now I realize others were not as pure, they were just trying to make money. But then I thought we were all pure.

Jobs later told his biographer that if it had not been for Wozniak's blue boxes, "there wouldn't have been an Apple."[15]

Blue boxing hit the mainstream media when an article by Ron Rosenbaum titled Secrets of the Little Blue Box was published in the October 1971 issue of Esquire magazine.[11] Suddenly, many more people wanted to get into the phone phreaking culture spawned by the blue box, and it furthered the fame of Captain Crunch.

Two major amateur radio magazines ('73' and "CQ') published articles on the telephone system in the mid-1970s. CQ Magazine published details on phone phreaking, including the tone frequencies and several working blue box schematics in 1974.[16] The June 1975 issue of 73 magazine carried an article describing the rudiments of the long-distance signaling network, and how to construct and operate red and blue boxes.[17] Around the same time, do-it-yourself blue box kits became available.[18][19]

In November 1988, the CCITT (now known as ITU-T) published recommendation Q.140 for the Signaling System No. 5, which caused a resurgence of blue boxing by a new generation of users.

In the early 1990s, blue boxing became popular with the international warez scene, especially in Europe. Software was made to enable blue boxing using a computer to generate and play the signaling tones. For the PC there were BlueBEEP, TLO, and others, and blue boxes were available for other platforms such as Amiga.

Local plain old telephone service works by watching the voltage on the telephone lines between the telephone company's exchange office and the customer's telephone. When the phone is on-hook ("hung up") the approximately 48 volt electricity from the exchange flows to the phone and is looped back without passing through the handset. When the user picks up the handset, the current has to flow through the speaker and microphone in it, causing the voltage to drop to under 10 V. This sudden drop in voltage signals the user has picked up the phone.

Originally, all calls were routed manually by an operator who would look for small light bulbs that would illuminate when a subscriber picked up the phone to make a call. The operator would connect a handset to the line, ask the user who they were calling, and then connect a cable between two phone jacks to complete the call. If the user was placing a long-distance call, the local operator would first talk to an operator at the remote exchange using one of the trunk lines between the two locations. When the local operator heard the remote customer come on the line, they would connect their local customer to the same trunk line to complete the call.

The calling process began to be automated from the earliest days of the telephone system. Increasingly sophisticated electromechanical systems would use the changes in voltage to start the connection process. The rotary dial was introduced around 1904 to operate these switches; the dial repeatedly rapidly connects and disconnects the line, a process known as pulse dialing. In common systems, these periodic changes in voltage caused a stepper motor to rotate one position for each pulse of a digit, with longer pauses to switch from one rotary switch to another. When enough digits had been decoded, typically seven in North America, connections between the rotors would select a single line, the customer being dialed.

The idea of using changing voltages to complete the call worked well for the local exchange where the distance between the customer and exchange office might be on the order of a few kilometers. Over longer distances, the capacitance of the lines filter out any rapid changes in voltage and dialing pulses do not reach the remote office in clean form, so that long-distance calls still required operator intervention. As telephone use grew, long-distance calling in particular, telephone companies were increasingly interested in automating this type of connection.

To address this need, the Bell System adopted a second system on the circuits that connected the exchanges. When the user dialed a long-distance number, indicated in North America by dialing a "1" at the beginning of the number, the call was switched to a separate system known as a "tandem". The tandem would then buffer the remaining digits and decode the number to see which remote exchange was being dialed, generally using the area code for this purpose. They would then look for a free trunk line between the two exchanges; if none were available the tandem would play the "fast busy" reorder signal to tell the user to try again later.[11]

The basic protocol for finding a free line worked by playing a 2600 Hz tone into the line whenever it was not being used. The tandems at both ends of a given trunk line did this. When the tandem determined which remote exchange was being called it scanned the trunk lines between the two exchanges looking for the tone. When it heard the tone on one of the lines, it knew that line was free to use. They would then select that line and drop the 2600 Hz tone from their end. The remote tandem would hear the tone stop, drop their tone, and then play a supervision flash, making a "ka-cheep" sound, to indicate they had noticed the signal. The line was now free on both ends to connect a call.[11]

Pulse dialing still had the problem that sending the dialed number to the remote exchange would not work due to the capacitance of the network. The tandems solved this by buffering the phone number and then converting each digit into a series of two tones, the multi-frequency signaling system, or "MF". Once the local tandem had found a free line and connected to it, it then relayed the rest of the phone number over the line using the tone dialing method. The remote tandem then decoded the tones and turned them back into pulses on the local exchange. To indicate the start and end of a series of MF digits, special MF tones, KP and ST, were used.[11]

When the call was finished and one of the parties hung up the phone, their exchange would notice the change in voltage and begin playing the 2600 Hz tone into the trunk line. The other end of the connection would respond to the tone by causing their local call to hang up as well, and then began playing the tone into their end as before, to mark the line as free at both ends.[11]

The blue box consisted of several of audio oscillators, a telephone keypad, an audio amplifier and a speaker. To operate a blue box, the user placed a long-distance telephone call, often to a number that was in the target area. Usually, this initial call would be to a 1-800 number or some other non-supervising telephone number such as directory assistance.[11] Using a toll-free number ensured that the phone being used for access would not be billed.

When the call began to ring, the caller would hold the blue box speaker over the microphone in the handset and use the box to send the 2600 Hz tone (or 2600+2400 Hz on many international trunks followed by a 2400 Hz tone). The called office interprets this tone as the caller hanging up before the call completed, disconnects the call, and begins playing 2600Hz to mark the line free. However, this does not disconnect the call at the caller's end, only physically hanging up the phone will do that. This leaves the caller on a live line that is connected via a long-distance trunk line to a target exchange.[11]

The caller now stops playing the tone. The called exchange interprets this loss of tone to mean the exchange's tandem is attempting to place another call. It responds by dropping its tone and then playing the flash to indicate it is ready to accept routing tones. Once the called end sends the supervision flash, the caller uses the blue box to send a "Key Pulse" or "KP", the tone that starts a routing digit sequence, followed by either a telephone number or one of the numerous special codes that were used internally by the telephone company, then finished with a "Start" tone, "ST".[11] At this point, the called end of the connection would route the call the way it was told, while the caller's local exchange would act as if the call was still ringing at the original number.

Blue boxing remained rare until the early 1970s when the required systems began to drop in cost and the concept began to be more widely known. At the time, phreakers felt there was nothing Bell Telephone could do to stop blue boxing because it would require Bell to upgrade all their hardware.[11]

For the immediate term, Bell responded with a number of blue box detection and law enforcement countermeasures. Armed with records of all long-distance calls made, kept by both mechanical switching systems and newer electronic switching systems, including calls to toll-free telephone numbers which did not appear on customer bills, telephone security employees began examining those records looking for suspicious patterns of activity. For instance, at the time, calls to long-distance information, while answered, deliberately did not return the electrical "off hook" signal indicating that they had been answered. When an information call was diverted to another number that answered, the billing equipment would log that event. Billing computers processed the logs and generated lists of calls to information that had been answered with an off-hook tone. In the early days, the lists were probably intended to detect equipment malfunctions, but the follow-up investigation did lead to blue box users. After the toll free "800" service was inaugurated, the billing computers were also programmed to generate lists of lengthy calls to toll free numbers. While many of these calls were legitimate, telephone security employees would examine the lists and follow up irregularities.

In this case, filters could be installed on those lines to block the blue box. Bell also would wiretap the affected lines. In one 1975 case, the Pacific Telephone Company targeted one defendant's line with the following equipment:

• A CMC 2600, a device which registers on a counter the number of times a 2600 Hz tone is detected on the line;
• A tape recorder, activated automatically by the CMC 2600 to record two minutes of telephone audio after each burst of 2600 Hz activity; and
• A Hekemian 51A, which replicates the functions of the CMC 2600 and also produces a paper tape print-out of outgoing calls. Ordinary calls were recorded in black ink and destination numbers called via the blue box were recorded in red ink.[20]

These actions resulted in several highly publicized trials.

The ultimate solution to the blue box vulnerability was to do what the phreakers thought impossible and upgrade the entire network. This process occurred in stages, some of which were already well underway in the early 1970s.

The T1 system was developed beginning in 1957 and began to be deployed around 1962. It digitized the voice signals so that they could be more efficiently carried in high-density connections between exchanges, carrying 24 lines on a single 4-wire connection. Depending on the network layout, the user might no longer be connected directly to a tandem, but instead to a local office that forwarded the signal over a T1 to a more distant exchange that did have the tandem. Simply due to the way the system worked, the supervisory signals had to be filtered out in order for the digitization of the analog signal to work. Recall that the 2600 Hz tone was not dropped from the trunk until the line was connected all the way and would be mixed with other tones like the ringing or busy signal; when used over a T1 this tone mixed with other signals and caused a problem known as "quantization noise" that distorted the sound. These tones were thus filtered down on either side of the T1 connection. Thus it was difficult to blue box in such an environment, although successes are known.

But blue boxing was eventually eliminated entirely for unrelated reasons. In the existing tandem-based network, completing a call required several stages communicating over the trunk line, even if the remote user never answered the call. As this process might take on the order of 10 to 15 seconds, the total wasted time across all of the trunk lines could be used to carry additional calls. To improve line usage, Bell began the development of the Number One Electronic Switching System (1ESS). This system performed all the calling and line supervision using a separate private line between the two offices. Using this system, when a long-distance call was placed the trunk line was not initially used. Instead, the local office sent a message containing the called number to the remote exchange using this separate channel. The remote office would then attempt to complete the call, and indicate this to the original office using the same private line. Only if the remote user answered would the systems attempt to find a free trunk line and connect, thereby reducing the use of the trunk lines to the absolute minimum.

This change also meant the signaling system was available internally to the network on this separate line. There was no connection between the user lines and this signaling line, so there was no route by which the users could influence the dialing. The same rapid reduction in prices that made the blue box possible also led to the rapid reduction in cost of the ESS systems. First applied only to their busiest connections, by the 1980s, the latest 4ESS models and similar machines from other companies were deployed to almost all major exchanges, leaving only corners of the network still connected using tandems. Blue boxing worked if one connected to such an exchange, but could only be used end-to-end if the entire network between the two endpoints consisted only of tandems, which became increasingly rare and disappeared by the late 1980s.

Analog long-distance transmission systems remained more cost effective for the long haul circuits until, at least, the 1970s. Even then, there was a huge installed base of analog circuits, and it made better economic sense to keep using them. It was not until competitor Sprint built its all digital, "quiet", network, where "you could actually hear a pin drop",[21] that AT&T took a multi-billion dollar write-off and upgraded its long-distance network to digital technology.

The phreaking community that had emerged during the blue box era evolved into other endeavors and there currently exists a commercially published hacking magazine, titled 2600, a reference to the 2600 Hz tone that was once central to so much of telephone hacking.[22]